search

NICMx / Jool

SIIT and NAT64 for Linux
GNU General Public License v2.0
332 stars 66 forks source link

4.1.13: Jool error: Netfilter is the only available instance framework. #424

Closed herenickname closed 2 months ago

herenickname commented 2 months ago

After upgrading from 4.1.9 (apt debian) and 4.1.7 (nicmx) to 4.1.13 from github releases I can no longer use jool with iptables.

dmesg:

[   17.327521] jool_common: loading out-of-tree module taints kernel.
[   17.328974] jool_common: module verification failed: signature and/or required key missing - tainting kernel
[   17.336241] Jool: Core Jool v4.1.13.0 module inserted.
[   17.338252] NAT64 Jool v4.1.13.0 module inserted.
[   17.362854] Jool error: Netfilter is the only available instance framework.
[  198.418113] Jool error: This namespace lacks an instance named 'default'.

Overall, traffic is being handled, but these messages make me question the reliability of my infrastructure for heavy load. I may be wrong, I'm not very familiar with networking, I apologize.

I am using jool as a nat64 ([v6]/96->[v4]/0) solution on my wireguard network of multiple gateways (each with its own jool instance with its own pool6).

Periodically I noticed how jool 4.1.7 and 4.1.9 with iptables(v4) mangle enabled were causing a lot of TCP Retransmission packets on my network. Everything would start to slow down and timeout. Excluding this v4 rule from iptables worked for me, but maybe thats subjective.

uname: Linux 6.1.0-23-amd64 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 GNU/Linux

ydahhrk commented 2 months ago

Should be fixed in 518790de38d8b043326c93b76d770d6f84f26c7c.